Hacker News Reader

Comment by weinzierl | Hacker News Reader

> Users with a Facebook account can opt-out of the ad scheme by adjusting their settings, while non-Facebook members can opt-out through the Digital Advertising Alliance in the US, the Digital Advertising Alliance in Canada, and the European Interactive Digital Advertising Alliance in Europe.

...or by using a wide-spectrum blocker like uBlock Origin, and for the cookie warning problem there is a solution too: "EU: Prebake - Filter Obtrusive Cookie Notices"[1]

[1] https://raw.githubusercontent.com/liamja/Prebake/master/obtr...

View on HN

Also use extensions like NoScript/Privacy Badger to block the background scripts

I enjoy using NoScript but I found I could not recommend it to non-techie friends, as it requires a lot of manual input to not break webpages. Is Privacy Badger more user friendly?

NoScript really needs a black-list mode powered by a community-curated filter similar to adblock filters.

How is a NoScript with community filters different from uBlock/AdBlock? It would be vulnerable to the same profit-driven whitelisting AdBlock does.

It would be the same i think; If NoScript pulled the same thing AdBlock Plus did there would be a new app taking its place(like how uBlock Origin did)

I don't believe privacy badger has broken any sites for me, I just run it in the background and let it do its thing, but it will of course be less effective than noscript because it doesn't break sites, and often the domains you want to block will break the site.

With Privacy Badger, there were a few months not too far back ago, where on certain sites (e.g., sports blogs) when browsing in private mode (Firefox), the first time I would visit a site, it would work. Then every subsequent time it would not work (broken layout). My (unproven) conclusion was the first time, it hadn't decided the (JS? cookies?) were tracking me, but after that it decided it had. I haven't had this problem in the last few months, though.

it _is_ more user friendly but not as powerful as NoScript. I totally feel the same way about telling non-techie friends since they just "allow all temporarily" once they see the site is broken....

I opted out long ago with my hosts file.

One of the best:

http://someonewhocares.org/hosts/

I also block

  127.0.0.1 connect.facebook.net
  127.0.0.1 www.facebook.com
  127.0.0.1 facebook.com
  127.0.0.1 platform.twitter.com
  127.0.0.1 assets.pinterest.com
  127.0.0.1 www.pinterest.com
  127.0.0.1 gravatar.com

But some terrible web code breaks and have to uncomment selectively. (Looking at you, Rotten tomatoes)

Or my personal favorite, 127.0.0.1?

Facebook has multiple domains with an A record resolving to 127.0.0.1. Go ahead and look at the response headers of a www.facebook.com request.

Why would Facebook do that?

To talk to programs on the users computer of course.

To be more specific, this is the HTTP response header that contains _some_ domains that resolve to the local loopback device, formatted to fit nicely.

    content-security-policy: 
         default-src * data: blob:;script-src *.facebook.com *.fbcdn.net   
         *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:*
         *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' 
         fbstatic-a.akamaihd.net 
         fbcdn-static-b-a.akamaihd.net 
         *.atlassolutions.com blob: 
         chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl;style-src * 'unsafe-inline' 
         data:;connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* 
         *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* 
         *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: 127.0.0.1:*;

What's really fucked up, is that I am on my windows pc now, and I typed 'https://fb.scanandcleanlocal.com/' into my browser and it _worked_. It resolved to 127.0.0.1:443 and it just shows a blank page. My computer must have a virus.

Reply on news.ycombinator.com